# Filebeat and logstash not communicating

**URL:** <https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639>\
**Category:** Logstash\
**Created:** [February 15, 2019, 7:48pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639 "2019-02-15T19:48:35Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 7:48pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/1 "2019-02-15T19:48:35Z")

</div>

I have simplest configuration

I have follwoing on system where log is being shipped from  
cat filebeat.yml |grep -v '#' |sed '/^$/d'  
filebeat.inputs:

- type: log  
enabled: true  
paths:
  - /tmp/sensors\*.log  
scan\_frequency: 10s  
filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: false  
output.logstash:  
hosts: ["elktst01:5044"]  
console:  
pretty: true  
logging.level: debug

I have following on logstash config file.  
cat beats.conf |grep -v '#' | sed '/^$/d'  
input {  
beats {  
port =\> "5044"  
}  
}

filter {  
}

output {  
stdout { codec =\> rubydebug }  
}

But nothing is showing up on logstash output.  
no output at all.

filebeat says it is harvesting file. but nothing on other side

Both machines are in in same network, both on linux system. no one has firewall setup.  
I know I must be missing some tiny stuff somewhere.

This is not working from week now.

I can telnet elktst01 5044 from system where filebeat is running

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2019, 7:52pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/2 "2019-02-15T19:52:56Z")

</div>

Your configuration is unreadable. Please edit your post, select the text of the configuration and click on \</\> in the toolbar above the editing pane.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 7:55pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/3 "2019-02-15T19:55:37Z")

</div>

> [@elasticforme](#):
>
> cat filebeat.yml |grep -v '#' |sed '/^$/d'  
> filebeat.inputs:
> 
> - type: log  
> enabled: true  
> paths:
> - /tmp/sensors\*.log  
> scan\_frequency: 10s  
> filebeat.config.modules:  
> path: ${path.config}/modules.d/\*.yml  
> reload.enabled: false  
> output.logstash:  
> hosts: ["elktst01:5044"]  
> console:  
> pretty: true  
> logging.level: debug
> 
> I have following on logstash config file.  
> cat beats.conf |grep -v '#' | sed '/^$/d'  
> input {  
> beats {  
> port =\> "5044"  
> }  
> }
> 
> filter {  
> }
> 
> output {  
> stdout { codec =\> rubydebug }  
> }

```
indent preformatted text by 4 spaces

```

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 7:58pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/4 "2019-02-15T19:58:42Z")

</div>

is it now readable?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2019, 7:59pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/5 "2019-02-15T19:59:55Z")

</div>

No. Looks like you quoted it rather than using blockquote (i.e. \</\>).

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 8:01pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/6 "2019-02-15T20:01:49Z")

</div>

> Blockquote  
> cat filebeat.yml |grep -v '#' |sed '/^$/d'  
> filebeat.inputs:

-type: log  
enabled: true  
paths:

- /tmp/sensors\*.log  
scan\_frequency: 10s  
filebeat.config.modules:  
path: ${path.config}/modules.d/\*.yml  
reload.enabled: false  
output.logstash:  
hosts: ["elktst01:5044"]  
console:  
pretty: true  
logging.level: debug

I have following on logstash config file.  
cat beats.conf |grep -v '#' | sed '/^$/d'  
input {  
beats {  
port =\> "5044"  
}  
}

filter {  
}

output {  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 8:02pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/7 "2019-02-15T20:02:26Z")

</div>

ok used blockquote. lets see if you can read. it. Since day one I have not figure out how to cut paste with proper formatting on this site.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 8:09pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/8 "2019-02-15T20:09:14Z")

</div>

I don't like output on logstash server  
Starting input listener {:address=\>"0.0.0.0:5044"}

why it is starting tcp port on 0.0.0.0 I need that on ip address. may be that is the problem here

---

<div class="post-metadata">

**Author:** ![pjanzen](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pjanzen/32/13756_2.png) [@pjanzen](https://discuss.elastic.co/u/pjanzen)\
**Post date:** [February 15, 2019, 8:21pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/9 "2019-02-15T20:21:41Z")

</div>

Your config is saying "listen to all available ips"

```
input {
    beats {
        port => "5044"
    }
}

```

If you add the host parameter you can specify an ip.

```
input {
    beats {
        host => "<you logstash host ip address>"
        port => "5044"
    }
}

```

after restarting logstash, you will see listening on the specified ip.

Paul.

---

<div class="post-metadata">

**Author:** ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)\
**Post date:** [February 15, 2019, 8:26pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/10 "2019-02-15T20:26:58Z")

</div>

perefect now it is working.

basically I had to do two thing. add host =\> "hostname" in to logstash conf file  
and add IP address in to filebeat.yml

netstat -pan |grep LISTEN |grep 5044 ( now shows up ip\_addr:5044)

now I am getting my file transfer over.

Thank you all.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [February 15, 2019, 9:04pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/11 "2019-02-15T21:04:07Z")

</div>

> [@pjanzen](#):
>
> Your config is saying "listen to all available ips"

I have seen programs that use 0.0.0.0 to mean "all available IPs that are not part of reserved CIDR blocks". I.e., it would not listen on an address in 192.168/16.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 15, 2019, 9:12pm UTC](https://discuss.elastic.co/t/filebeat-and-logstash-not-communicating/168639/12 "2019-03-15T21:12:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.